Seeq Knowledge Base
Latest R65 R58 Cloud On-Premise
Seeq Knowledge Base
Latest R65 R58 Cloud On-Premise
Breadcrumbs

Workaround: Manually distrust the compromised eMudhra CAs on a Seeq Remote Agent

Overview

The private keys of eight eMudhra intermediate CA certificates have been compromised, meaning an attacker could mint TLS certificates that software would trust. OpenJDK's advisory (https://openjdk.org/emudhra) identifies the affected intermediate CAs and recommends removing the root CAs they chain to from the JDK's trust store. A Seeq Remote Agent that runs on Seeq's bundled JDK trusts those roots by default, so until it is patched it could accept a forged certificate from an affected CA.

Seeq's fix ships a patched agent whose bundled JDK removes the affected root CAs — AAA Certificate Services, emSign Root CA – G1, emSign Root CA – G2, and emSign ECC Root CA – G3 — per OpenJDK's guidance, and also blocks the 16 compromised intermediate certificates by fingerprint.

Upgrading the Remote Agent to the patched build is the supported fix. This document is a manual stopgap for sites that cannot upgrade right away: it performs the root-removal step by hand on an existing agent. It is temporary — any reinstall, or non-patched upgrade reverts it.

Use this only if you cannot upgrade the Remote Agent to the patched build. Upgrading is the supported fix; this manual stopgap reproduces what the patched agent's bundled JDK does.

Preconditions

  1. You need administrator rights on the agent machine where the workaround is applied.

  2. Schedule a short maintenance window as the agent must restarted as part of the procedure.

  3. Check your data sources first: if any server the agent connects to presents a TLS certificate that chains to AAA Certificate Services (an older Comodo/Sectigo root), that connection will stop working after this change. Re-issue those certificates under a current (uncompromised) CA before proceeding.

Procedure

  1. Stop the Seeq Remote Agent (stop its Windows service).

  2. Open the Seeq Command Prompt

  3. Back up the keystore:

    copy "%JAVA_HOME%\lib\security\cacerts" "%JAVA_HOME%\lib\security\cacerts.bak"

  4. See which of the roots are present (alias names vary slightly by JDK version):

    keytool -list -keystore "%JAVA_HOME%\lib\security\cacerts" | findstr /i "emsign comodoaaa"

  5. Delete the distrusted roots. Run all six of the following commands in the Seeq Command Prompt. Any that report "Alias … does not exist" simply weren't in your version; Those warnings are safe to ignore:

    keytool -delete -alias "comodoaaaca [jdk]" -keystore "%JAVA_HOME%\lib\security\cacerts"

keytool -delete -alias "emsignrootca-g1" -keystore "%JAVA_HOME%\lib\security\cacerts"

keytool -delete -alias "emsignrootcag1 [jdk]" -keystore "%JAVA_HOME%\lib\security\cacerts"

keytool -delete -alias "emsignrootcag2 [jdk]" -keystore "%JAVA_HOME%\lib\security\cacerts"

keytool -delete -alias "emsigneccrootca-g3" -keystore "%JAVA_HOME%\lib\security\cacerts"

keytool -delete -alias "emsigneccrootcag3 [jdk]" -keystore "%JAVA_HOME%\lib\security\cacerts"

  6. Verify — this should now list only the two C-series roots (emsignrootca-c1, emsigneccrootca-c3) and no G1/G2/G3/AAA:

    keytool -list -keystore "%JAVA_HOME%\lib\security\cacerts" -storepass changeit | findstr /i "emsign comodoaaa"

  7. Restart the Seeq Remote Agent (start the service, or use seeq start).

Roll Back

This step undoes the change and is only needed to recover from a problem (for example, a connection that should still work stops trusting).

To roll back, stop the agent, copy cacerts.bak back over cacerts, and restart.

copy "%JAVA_HOME%\lib\security\cacerts.bak" "%JAVA_HOME%\lib\security\cacerts"

Notes

  1. These changes are made inside the bundled JDK, so a repair/reinstall or any upgrade that is not the patched build will revert them — re-apply if that happens. Upgrading to the patched agent makes the workaround unnecessary.

  2. On Windows the agent also trusts certificates from the Windows root store, which contains AAA Certificate Services, so removing the root from the bundled JDK does not fully distrust it on its own. To fully distrust these CAs on Windows, upgrade to the patched agent (recommended — it also filters these roots out of the Windows store), or additionally remove them from the Windows Trusted Root Certification Authorities store (can affect other software and may be re-added by Windows Automatic Root Update).